@rebasepro/cms 0.23.0 → 0.24.0

package/dist/{util-CC0ozHoD.js → util-D7ebttKT.js}

@@ -60,11 +60,15 @@ function getPreviewSizeFrom(size) {
 * stored 15th showed as the 14th west of Greenwich, and a 15th picked east of
 * it was stored as the 14th.
 *
+* A `columnType: "time"` column holds a time of day with no zone, and travels
+* as that time on 1970-01-01 UTC, so it is shown in UTC too: in the browser's
+* zone a stored 09:30 read as 10:30 in Rome.
+*
 * Any other date is shown in the property's declared `timezone`, or the
 * browser's when it declares none.
 */
 function getDatePropertyTimezone(property) {
-	return property.columnType === "date" ? "UTC" : property.timezone;
+	return property.columnType === "date" || property.columnType === "time" ? "UTC" : property.timezone;
 }
 /**
 * Whether a date property is picked and shown as a day or a day and a time. A
@@ -87,4 +91,4 @@ function isEmptyPreviewValue(value) {
 //#endregion
 export { isEmptyPreviewValue as a, getThumbnailMeasure as i, getDatePropertyTimezone as n, sanitizeUrl as o, getPreviewSizeFrom as r, getDatePropertyMode as t };
 
-//# sourceMappingURL=util-CC0ozHoD.js.map
+//# sourceMappingURL=util-D7ebttKT.js.map

package/dist/{util-CC0ozHoD.js.map → util-D7ebttKT.js.map}

@@ -1 +1 @@
-{"version":3,"file":"util-CC0ozHoD.js","names":[],"sources":["../src/preview/util.ts"],"sourcesContent":["import { CollectionSize } from \"@rebasepro/cms-types\";\nimport type { DateProperty } from \"@rebasepro/types\";\nimport type { PreviewSize } from \"../types/components/PropertyPreviewProps\";\n/**\n * The schemes a preview link may use — everything else becomes `about:blank`.\n *\n * An allowlist, because the blocklist it replaces could be walked around and\n * the walk-arounds are not exotic. Browsers strip tabs, newlines and carriage\n * returns from a URL before parsing the scheme, so `java\\tscript:alert(1)` and\n * `java%0ascript:…` navigate exactly as `javascript:` does while matching none\n * of the names a blocklist knows. A leading control character does the same.\n *\n * Turned around, none of that matters: a string is either one of these four\n * schemes or it is not a link this panel will follow. `mailto:` and `tel:` are\n * here because a contact field is an ordinary thing to preview; `data:` is not,\n * even for images — a preview renders an `<img>` from its own value rather than\n * navigating to one.\n *\n * Relative URLs are allowed and deliberately: a preview commonly holds\n * `/uploads/x.png`, and a string with no scheme cannot carry one.\n */\nconst ALLOWED_URL_SCHEMES = new Set([\"http:\", \"https:\", \"mailto:\", \"tel:\"]);\n\nexport function sanitizeUrl(url: string | undefined): string {\n    if (!url) return \"about:blank\";\n\n    // The characters a browser removes before it decides what the scheme is.\n    // Stripped here for the same reason, so this function is looking at the\n    // string the browser will act on rather than the one it was handed.\n    //\n    // The control characters are the point, so the rule that objects to them is\n    // off for this line rather than the expression rewritten to hide them from\n    // it: `java\\tscript:` and `java\\nscript:` are the bypasses this exists to\n    // close, and a regex that cannot name a control character cannot remove one.\n    // eslint-disable-next-line no-control-regex\n    const trimmed = url.trim().replace(/[\\u0000-\\u001F\\u007F]/g, \"\");\n    if (!trimmed) return \"about:blank\";\n\n    // No scheme at all — a relative link, which cannot navigate anywhere the\n    // page could not already reach.\n    if (!/^[a-z][a-z0-9+.-]*:/i.test(trimmed)) return trimmed;\n\n    try {\n        // `new URL` normalizes percent-encoding and case, so\n        // `JaVaScRiPt%3aalert(1)` is judged as what it resolves to. The base is\n        // there only so a protocol-relative `//host/path` parses.\n        const parsed = new URL(trimmed, \"https://example.invalid\");\n        return ALLOWED_URL_SCHEMES.has(parsed.protocol) ? trimmed : \"about:blank\";\n    } catch {\n        return \"about:blank\";\n    }\n}\n\nexport const SMALL_THUMBNAIL = 40;\nexport const MEDIUM_THUMBNAIL = 100;\nexport const LARGE_THUMBNAIL = 200;\n\nexport function getThumbnailMeasure(size: PreviewSize): number {\n    if (size === \"small\")\n        return SMALL_THUMBNAIL;\n    else if (size === \"medium\")\n        return MEDIUM_THUMBNAIL;\n    else if (size === \"large\")\n        return LARGE_THUMBNAIL;\n    else throw Error(\"Thumbnail size not mapped\");\n}\n\nexport function getPreviewSizeFrom(size: CollectionSize): PreviewSize {\n    switch (size) {\n        case \"xs\":\n        case \"s\":\n        case \"m\":\n            return \"small\";\n        case \"l\":\n            return \"medium\";\n        case \"xl\":\n            return \"large\";\n        default:\n            throw Error(\"Missing mapping value in getPreviewSizeFrom: \" + size);\n    }\n}\n\n/**\n * The zone a date property is shown and entered in.\n *\n * A `columnType: \"date\"` column holds a calendar day with no zone. It travels\n * as that day's UTC midnight, and Postgres keeps the date part of whatever it\n * is given, so it is read and written in UTC. In the browser's own zone a\n * stored 15th showed as the 14th west of Greenwich, and a 15th picked east of\n * it was stored as the 14th.\n *\n * Any other date is shown in the property's declared `timezone`, or the\n * browser's when it declares none.\n */\nexport function getDatePropertyTimezone(property: DateProperty): string | undefined {\n    return property.columnType === \"date\" ? \"UTC\" : property.timezone;\n}\n\n/**\n * Whether a date property is picked and shown as a day or a day and a time. A\n * `date` column holds no time, so it is a day whatever `mode` says.\n */\nexport function getDatePropertyMode(property: DateProperty): \"date\" | \"date_time\" | undefined {\n    return property.columnType === \"date\" ? \"date\" : property.mode;\n}\n\n/**\n * Whether a value has nothing to show: absent, a blank string, an empty list.\n * A preview of one draws the empty marker, which is the right thing for a\n * column of values and the wrong thing for the one line under a record's name.\n */\nexport function isEmptyPreviewValue(value: unknown): boolean {\n    if (value === undefined || value === null) return true;\n    if (typeof value === \"string\") return value.trim() === \"\";\n    if (Array.isArray(value)) return value.length === 0;\n    return false;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAqBA,IAAM,sCAAsB,IAAI,IAAI;CAAC;CAAS;CAAU;CAAW;AAAM,CAAC;AAE1E,SAAgB,YAAY,KAAiC;CACzD,IAAI,CAAC,KAAK,OAAO;CAWjB,MAAM,UAAU,IAAI,KAAK,CAAC,CAAC,QAAQ,0BAA0B,EAAE;CAC/D,IAAI,CAAC,SAAS,OAAO;CAIrB,IAAI,CAAC,uBAAuB,KAAK,OAAO,GAAG,OAAO;CAElD,IAAI;EAIA,MAAM,SAAS,IAAI,IAAI,SAAS,yBAAyB;EACzD,OAAO,oBAAoB,IAAI,OAAO,QAAQ,IAAI,UAAU;CAChE,QAAQ;EACJ,OAAO;CACX;AACJ;AAMA,SAAgB,oBAAoB,MAA2B;CAC3D,IAAI,SAAS,SACT,OAAA;MACC,IAAI,SAAS,UACd,OAAA;MACC,IAAI,SAAS,SACd,OAAA;MACC,MAAM,MAAM,2BAA2B;AAChD;AAEA,SAAgB,mBAAmB,MAAmC;CAClE,QAAQ,MAAR;EACI,KAAK;EACL,KAAK;EACL,KAAK,KACD,OAAO;EACX,KAAK,KACD,OAAO;EACX,KAAK,MACD,OAAO;EACX,SACI,MAAM,MAAM,kDAAkD,IAAI;CAC1E;AACJ;;;;;;;;;;;;;AAcA,SAAgB,wBAAwB,UAA4C;CAChF,OAAO,SAAS,eAAe,SAAS,QAAQ,SAAS;AAC7D;;;;;AAMA,SAAgB,oBAAoB,UAA0D;CAC1F,OAAO,SAAS,eAAe,SAAS,SAAS,SAAS;AAC9D;;;;;;AAOA,SAAgB,oBAAoB,OAAyB;CACzD,IAAI,UAAU,KAAA,KAAa,UAAU,MAAM,OAAO;CAClD,IAAI,OAAO,UAAU,UAAU,OAAO,MAAM,KAAK,MAAM;CACvD,IAAI,MAAM,QAAQ,KAAK,GAAG,OAAO,MAAM,WAAW;CAClD,OAAO;AACX"}
+{"version":3,"file":"util-D7ebttKT.js","names":[],"sources":["../src/preview/util.ts"],"sourcesContent":["import { CollectionSize } from \"@rebasepro/cms-types\";\nimport type { DateProperty } from \"@rebasepro/types\";\nimport type { PreviewSize } from \"../types/components/PropertyPreviewProps\";\n/**\n * The schemes a preview link may use — everything else becomes `about:blank`.\n *\n * An allowlist, because the blocklist it replaces could be walked around and\n * the walk-arounds are not exotic. Browsers strip tabs, newlines and carriage\n * returns from a URL before parsing the scheme, so `java\\tscript:alert(1)` and\n * `java%0ascript:…` navigate exactly as `javascript:` does while matching none\n * of the names a blocklist knows. A leading control character does the same.\n *\n * Turned around, none of that matters: a string is either one of these four\n * schemes or it is not a link this panel will follow. `mailto:` and `tel:` are\n * here because a contact field is an ordinary thing to preview; `data:` is not,\n * even for images — a preview renders an `<img>` from its own value rather than\n * navigating to one.\n *\n * Relative URLs are allowed and deliberately: a preview commonly holds\n * `/uploads/x.png`, and a string with no scheme cannot carry one.\n */\nconst ALLOWED_URL_SCHEMES = new Set([\"http:\", \"https:\", \"mailto:\", \"tel:\"]);\n\nexport function sanitizeUrl(url: string | undefined): string {\n    if (!url) return \"about:blank\";\n\n    // The characters a browser removes before it decides what the scheme is.\n    // Stripped here for the same reason, so this function is looking at the\n    // string the browser will act on rather than the one it was handed.\n    //\n    // The control characters are the point, so the rule that objects to them is\n    // off for this line rather than the expression rewritten to hide them from\n    // it: `java\\tscript:` and `java\\nscript:` are the bypasses this exists to\n    // close, and a regex that cannot name a control character cannot remove one.\n    // eslint-disable-next-line no-control-regex\n    const trimmed = url.trim().replace(/[\\u0000-\\u001F\\u007F]/g, \"\");\n    if (!trimmed) return \"about:blank\";\n\n    // No scheme at all — a relative link, which cannot navigate anywhere the\n    // page could not already reach.\n    if (!/^[a-z][a-z0-9+.-]*:/i.test(trimmed)) return trimmed;\n\n    try {\n        // `new URL` normalizes percent-encoding and case, so\n        // `JaVaScRiPt%3aalert(1)` is judged as what it resolves to. The base is\n        // there only so a protocol-relative `//host/path` parses.\n        const parsed = new URL(trimmed, \"https://example.invalid\");\n        return ALLOWED_URL_SCHEMES.has(parsed.protocol) ? trimmed : \"about:blank\";\n    } catch {\n        return \"about:blank\";\n    }\n}\n\nexport const SMALL_THUMBNAIL = 40;\nexport const MEDIUM_THUMBNAIL = 100;\nexport const LARGE_THUMBNAIL = 200;\n\nexport function getThumbnailMeasure(size: PreviewSize): number {\n    if (size === \"small\")\n        return SMALL_THUMBNAIL;\n    else if (size === \"medium\")\n        return MEDIUM_THUMBNAIL;\n    else if (size === \"large\")\n        return LARGE_THUMBNAIL;\n    else throw Error(\"Thumbnail size not mapped\");\n}\n\nexport function getPreviewSizeFrom(size: CollectionSize): PreviewSize {\n    switch (size) {\n        case \"xs\":\n        case \"s\":\n        case \"m\":\n            return \"small\";\n        case \"l\":\n            return \"medium\";\n        case \"xl\":\n            return \"large\";\n        default:\n            throw Error(\"Missing mapping value in getPreviewSizeFrom: \" + size);\n    }\n}\n\n/**\n * The zone a date property is shown and entered in.\n *\n * A `columnType: \"date\"` column holds a calendar day with no zone. It travels\n * as that day's UTC midnight, and Postgres keeps the date part of whatever it\n * is given, so it is read and written in UTC. In the browser's own zone a\n * stored 15th showed as the 14th west of Greenwich, and a 15th picked east of\n * it was stored as the 14th.\n *\n * A `columnType: \"time\"` column holds a time of day with no zone, and travels\n * as that time on 1970-01-01 UTC, so it is shown in UTC too: in the browser's\n * zone a stored 09:30 read as 10:30 in Rome.\n *\n * Any other date is shown in the property's declared `timezone`, or the\n * browser's when it declares none.\n */\nexport function getDatePropertyTimezone(property: DateProperty): string | undefined {\n    return property.columnType === \"date\" || property.columnType === \"time\" ? \"UTC\" : property.timezone;\n}\n\n/**\n * Whether a date property is picked and shown as a day or a day and a time. A\n * `date` column holds no time, so it is a day whatever `mode` says.\n */\nexport function getDatePropertyMode(property: DateProperty): \"date\" | \"date_time\" | undefined {\n    return property.columnType === \"date\" ? \"date\" : property.mode;\n}\n\n/**\n * Whether a value has nothing to show: absent, a blank string, an empty list.\n * A preview of one draws the empty marker, which is the right thing for a\n * column of values and the wrong thing for the one line under a record's name.\n */\nexport function isEmptyPreviewValue(value: unknown): boolean {\n    if (value === undefined || value === null) return true;\n    if (typeof value === \"string\") return value.trim() === \"\";\n    if (Array.isArray(value)) return value.length === 0;\n    return false;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAqBA,IAAM,sCAAsB,IAAI,IAAI;CAAC;CAAS;CAAU;CAAW;AAAM,CAAC;AAE1E,SAAgB,YAAY,KAAiC;CACzD,IAAI,CAAC,KAAK,OAAO;CAWjB,MAAM,UAAU,IAAI,KAAK,CAAC,CAAC,QAAQ,0BAA0B,EAAE;CAC/D,IAAI,CAAC,SAAS,OAAO;CAIrB,IAAI,CAAC,uBAAuB,KAAK,OAAO,GAAG,OAAO;CAElD,IAAI;EAIA,MAAM,SAAS,IAAI,IAAI,SAAS,yBAAyB;EACzD,OAAO,oBAAoB,IAAI,OAAO,QAAQ,IAAI,UAAU;CAChE,QAAQ;EACJ,OAAO;CACX;AACJ;AAMA,SAAgB,oBAAoB,MAA2B;CAC3D,IAAI,SAAS,SACT,OAAA;MACC,IAAI,SAAS,UACd,OAAA;MACC,IAAI,SAAS,SACd,OAAA;MACC,MAAM,MAAM,2BAA2B;AAChD;AAEA,SAAgB,mBAAmB,MAAmC;CAClE,QAAQ,MAAR;EACI,KAAK;EACL,KAAK;EACL,KAAK,KACD,OAAO;EACX,KAAK,KACD,OAAO;EACX,KAAK,MACD,OAAO;EACX,SACI,MAAM,MAAM,kDAAkD,IAAI;CAC1E;AACJ;;;;;;;;;;;;;;;;;AAkBA,SAAgB,wBAAwB,UAA4C;CAChF,OAAO,SAAS,eAAe,UAAU,SAAS,eAAe,SAAS,QAAQ,SAAS;AAC/F;;;;;AAMA,SAAgB,oBAAoB,UAA0D;CAC1F,OAAO,SAAS,eAAe,SAAS,SAAS,SAAS;AAC9D;;;;;;AAOA,SAAgB,oBAAoB,OAAyB;CACzD,IAAI,UAAU,KAAA,KAAa,UAAU,MAAM,OAAO;CAClD,IAAI,OAAO,UAAU,UAAU,OAAO,MAAM,KAAK,MAAM;CACvD,IAAI,MAAM,QAAQ,KAAK,GAAG,OAAO,MAAM,WAAW;CAClD,OAAO;AACX"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rebasepro/cms",
-  "version": "0.23.0",
+  "version": "0.24.0",
   "description": "Rebase CMS — content management views, forms, and routing",
   "keywords": [
     "rebase",
@@ -89,14 +89,14 @@
     "react-use-measure": "^2.1.7",
     "read-excel-file": "^9.3.10",
     "zod": "^4.4.3",
-    "@rebasepro/cms-types": "0.23.0",
-    "@rebasepro/app": "0.23.0",
-    "@rebasepro/inference": "0.23.0",
-    "@rebasepro/common": "0.23.0",
-    "@rebasepro/types": "0.23.0",
-    "@rebasepro/utils": "0.23.0",
-    "@rebasepro/ui": "0.23.0",
-    "@rebasepro/forms": "0.23.0"
+    "@rebasepro/app": "0.24.0",
+    "@rebasepro/cms-types": "0.24.0",
+    "@rebasepro/common": "0.24.0",
+    "@rebasepro/forms": "0.24.0",
+    "@rebasepro/inference": "0.24.0",
+    "@rebasepro/types": "0.24.0",
+    "@rebasepro/ui": "0.24.0",
+    "@rebasepro/utils": "0.24.0"
   },
   "peerDependencies": {
     "react": "^19.2.7",